The defect stems from a race condition in the Linux kernel’s ISOTP implementation: the transmit state machine (so->tx.state) is accessed from multiple contexts—sendmsg(), the receive path, and high‑resolution timer callbacks—without proper synchronization. A lock‑free compare‑and‑swap claim in sendmsg() can intermix with hrtimer cancellations made under so->rx_lock, allowing a frame or timer callback to act on a state that has already advanced. This can corrupt state tracking for an unrelated transfer, resulting in malformed CAN frames or a loss of critical traffic, effectively corrupting data and potentially leading to a denial of service on the CAN network.

All Linux kernel builds that include the ISOTP socket implementation before the commit that introduced the missing lock protection are affected. The vulnerability is present in the standard Linux kernel source and therefore impacts all distributions shipping an unpatched kernel that contains the ISOTP driver. Any system running an ISOTP socket before the fix is susceptible.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% shows that exploitation is currently considered unlikely. The vulnerability is not listed in CISA KEV and no public exploits have been reported. The description indicates a race condition within kernel space, so exploitation would require operating within that environment; this requirement is inferred from the context rather than explicitly stated. The lack of disclosed attack vector and the low exploitation probability mean that the risk remains elevated primarily in environments where CAN traffic is mission critical.